@sagentlab/navarch-runtime 0.1.17 → 0.1.19

package/README.md

@@ -264,7 +264,7 @@ unchanged across the deployment.
 | `NAVARCH_MAX_SESSIONS` | `5` | Local concurrent-session capacity cap — see `src/capacity.cts`. |
 | `NAVARCH_CAPABILITIES` | `shell,browser-use` (`docker-sandbox,shell` in Docker mode) | Comma list reported at heartbeat/claim time. Docker mode does not advertise browser use until the configured image provides it. |
 | `NAVARCH_OWNER_ZONE` | `sagentlab` | `sagentlab` or `customer-<slug>-premises` (project-plan.md §3.11). |
-| `NAVARCH_POLL_INTERVAL_MS` | `5000` | Claim-loop poll interval. |
+| `NAVARCH_POLL_INTERVAL_MS` | `30000` | Claim-loop poll interval. |
 | `NAVARCH_HEARTBEAT_INTERVAL_MS` | `60000` | Machine-level heartbeat interval. |
 | `NAVARCH_LEASE_HEARTBEAT_INTERVAL_MS` | `300000` | Per-lease heartbeat interval; must stay well under the 15-minute lease TTL (schema-design.md §4). |
 | `NAVARCH_SESSION_TIMEOUT_MS` | `2700000` (45 min) | Hard kill timeout for a single session. |
@@ -305,7 +305,12 @@ supported coding agents, using each CLI's native enforcement point:
 - **Codex:** the runtime passes a one-off native permission profile with
   `approval_policy="on-request"` and `approvals_reviewer="auto_review"`.
   Codex's OS sandbox grants read/write access only to the allowed roots and
-  denies the surrounding multi-session workspace, while eligible escalations
+  denies the surrounding multi-session workspace. Its network policy allows
+  GitHub and GitHub-hosted content so authenticated `gh` and git operations
+  required by the task stay inside the sandbox. `gh` reads from an empty,
+  session-owned `GH_CONFIG_DIR` and authenticates with the lease-scoped token,
+  so the operator's GitHub configuration and unrelated credentials remain
+  inaccessible. Other destinations remain blocked and eligible escalations
   are decided by the automatic reviewer rather than waiting for human input.
   `--ignore-user-config` and an untrusted project-config override prevent a
   user or checked-in legacy `sandbox_mode` from silently disabling the
@@ -330,8 +335,10 @@ The resulting boundary is:
   system prefixes.
 - The **rest of the workspace root** — sibling sessions' worktrees, other
   projects' bare repos, and the session's own metadata dir (lease-scoped MCP
-  config, the guard files themselves) — is denied outright, so an agent can
-  neither read another agent's checkout nor rewrite its own guard policy.
+  config, the guard files themselves) — is denied outright. The only metadata
+  exception is the empty, read-only `gh` config directory described above, so
+  an agent can neither read another agent's checkout nor rewrite its own guard
+  policy.
 
 The Claude hook is a strong guardrail rather than a hard security boundary
 because shell paths are screened lexically. Codex's permission profile is

package/dist/config.cjs

@@ -61,7 +61,7 @@ function loadRuntimeConfig(env = process.env) {
         maxSessions: envInt(env, "NAVARCH_MAX_SESSIONS", 5),
         capabilities: envList(env, "NAVARCH_CAPABILITIES", defaultCapabilities),
         ownerZone: env.NAVARCH_OWNER_ZONE ?? "sagentlab",
-        pollIntervalMs: envInt(env, "NAVARCH_POLL_INTERVAL_MS", 5000),
+        pollIntervalMs: envInt(env, "NAVARCH_POLL_INTERVAL_MS", 30_000),
         machineHeartbeatIntervalMs: envInt(env, "NAVARCH_HEARTBEAT_INTERVAL_MS", 60_000),
         // leases.expires_at = claimed_at + 15 min (schema-design.md §4) — default renewal
         // interval must stay comfortably under that TTL.

package/dist/git-worktree.cjs

@@ -23,13 +23,19 @@ class GitWorktree {
     runner;
     cloneUrl;
     githubToken;
+    taskBranchSuffix;
     constructor(options) {
         const projectKey = safePathSegment(options.projectId);
         const sessionKey = safePathSegment(options.sessionId);
+        const taskKey = safePathSegment(options.taskId);
         this.sessionRoot = node_path_1.default.join(options.workspaceRoot, "sessions", sessionKey);
         this.worktreePath = node_path_1.default.join(this.sessionRoot, "repo");
         this.repositoryPath = node_path_1.default.join(options.workspaceRoot, "repositories", `${projectKey}.git`);
-        this.branch = `navarch/${branchSlug(options)}-${sessionKey.toLowerCase().slice(0, 8)}`;
+        // One delivery task owns one remote branch across every retry. A
+        // session-scoped branch lets a failed attempt push useful work, then makes
+        // the retry start from main and open a second PR for the same task.
+        this.taskBranchSuffix = `-${taskKey.toLowerCase()}`;
+        this.branch = `navarch/${branchSlug(options)}${this.taskBranchSuffix}`;
         this.runner = options.runner ?? sandbox_cjs_1.nodeCommandRunner;
         this.cloneUrl = options.cloneUrl;
         this.githubToken = options.githubToken;
@@ -75,7 +81,10 @@ class GitWorktree {
         ], true);
     }
     async addSessionWorktree() {
-        const startRef = await this.resolveStartRef();
+        // A failed session may have pushed before it could report completion. The
+        // next session must resume that task-owned branch, not fork again from the
+        // default branch and create a competing delivery PR.
+        const startRef = (await this.resolveTaskBranchRef()) ?? (await this.resolveStartRef());
         if (!startRef) {
             // Empty remote (no commits yet): there is nothing to base the session on,
             // so bootstrap an orphan branch the session can push as the first commit.
@@ -93,6 +102,22 @@ class GitWorktree {
             startRef,
         ], false);
     }
+    /** Returns the fetched task-owned remote branch when an earlier attempt pushed it. */
+    async resolveTaskBranchRef() {
+        const refs = await this.runGit(["--git-dir", this.repositoryPath, "for-each-ref", "--format=%(refname)", "refs/remotes/origin/navarch"], false);
+        const matches = refs.stdout
+            .split("\n")
+            .map((line) => line.trim())
+            .filter((ref) => ref.endsWith(this.taskBranchSuffix));
+        if (matches.length === 0)
+            return null;
+        if (matches.length > 1) {
+            throw new Error(`Multiple remote branches claim task suffix ${this.taskBranchSuffix}; refusing to fork another delivery branch.`);
+        }
+        const remoteRef = matches[0];
+        this.branch = remoteRef.replace(/^refs\/remotes\/origin\//, "");
+        return remoteRef;
+    }
     /**
      * Resolves the remote-tracking ref new session branches start from, or null
      * when the remote has no branches at all (a freshly provisioned empty repo).
@@ -211,8 +236,8 @@ async function pathExists(value) {
     }
 }
 /**
- * Kebab-case slug for the session branch, derived from the task summary so
- * branch names read like `navarch/fix-login-redirect-a1b2c3d4` instead of a
+ * Kebab-case slug for the task branch, derived from the task summary so
+ * branch names read like `navarch/fix-login-redirect-<task-id>` instead of a
  * UUID mash. Falls back to the task type, then a task-id prefix, when the
  * summary yields nothing. Output contains only [a-z0-9-] with no leading or
  * trailing dash, so it is always a valid git ref component (no `..`, no
@@ -239,7 +264,7 @@ function branchSlug(options) {
 function safePathSegment(value) {
     const safe = value.replace(/[^A-Za-z0-9_.-]/g, "-").replace(/^-+|-+$/g, "");
     if (!safe)
-        throw new Error("Cannot create a git worktree without a valid project/session identifier.");
+        throw new Error("Cannot create a git worktree without a valid identifier.");
     return safe;
 }
 function normalizeCloneUrl(value) {

package/dist/session.cjs

@@ -95,6 +95,7 @@ async function runSession(deps, claimed, sessionId) {
             leaseId,
         };
     }
+    const sessionEnv = toEnvMap(secrets, gitCredentialRefresh, config.gitAuthorName, config.gitAuthorEmail);
     const cloneUrl = bundle.repository?.clone_url ??
         (task.repo ? `https://github.com/${task.repo.replace(/\.git$/, "")}.git` : null);
     if (!cloneUrl) {
@@ -241,6 +242,9 @@ async function runSession(deps, claimed, sessionId) {
             }
         }
         else if (runtime === "codex") {
+            const ghConfigDir = (0, worktree_guard_cjs_1.codexGhConfigDir)(workDir);
+            await node_fs_1.promises.mkdir(ghConfigDir, { recursive: true, mode: 0o700 });
+            sessionEnv.GH_CONFIG_DIR = ghConfigDir;
             codexGuardArgs = (0, worktree_guard_cjs_1.codexWorktreeGuardArgs)({
                 workDir,
                 worktreePath: gitWorktree.worktreePath,
@@ -266,7 +270,7 @@ async function runSession(deps, claimed, sessionId) {
         await gitWorktree.prepare();
         if (sandbox) {
             await sandbox.create();
-            await sandbox.injectEnv(toEnvMap(secrets, gitCredentialRefresh, config.gitAuthorName, config.gitAuthorEmail));
+            await sandbox.injectEnv(sessionEnv);
         }
         // The control plane returns the agent type selected for this worker.
         // Any agent type may run any task; capabilities remain the task-level gate.
@@ -300,7 +304,7 @@ async function runSession(deps, claimed, sessionId) {
                 model: execution.model,
                 reasoningEffort: execution.reasoning_effort,
                 timeoutMs: config.sessionTimeoutMs,
-                env: toEnvMap(secrets, gitCredentialRefresh, config.gitAuthorName, config.gitAuthorEmail),
+                env: sessionEnv,
                 settingsPath: claudeSettingsPath,
                 codexGuardArgs,
                 geminiSandboxMounts: geminiGuardMounts,
@@ -468,7 +472,10 @@ async function runSession(deps, claimed, sessionId) {
         // every other body we surface) so a 4xx/5xx completion stays diagnosable.
         const crashDetail = (0, redact_cjs_1.redactText)(describeCompletionError(err), knownSecrets);
         log.error(`session ${leaseId} threw before completing: ${crashDetail}`);
-        const failureSummary = (0, redact_cjs_1.redactText)(`Session crashed: ${String(err)}`, knownSecrets);
+        // Send the same bounded, redacted detail to the control plane that we log
+        // locally. NavarchApiError.message contains only the HTTP status line; its
+        // response body carries the actionable server error shown in session UI.
+        const failureSummary = `Session crashed: ${crashDetail}`;
         await api
             .completeLease(leaseId, {
             status: "failed",

package/dist/worktree-guard.cjs

@@ -7,12 +7,18 @@ exports.guardHookScriptPath = guardHookScriptPath;
 exports.readClaudeApiKeyHelper = readClaudeApiKeyHelper;
 exports.prepareWorktreeGuard = prepareWorktreeGuard;
 exports.codexToolReadRoots = codexToolReadRoots;
+exports.codexGhConfigDir = codexGhConfigDir;
 exports.codexWorktreeGuardArgs = codexWorktreeGuardArgs;
 exports.geminiSandboxMounts = geminiSandboxMounts;
 const node_path_1 = __importDefault(require("node:path"));
 const node_fs_1 = require("node:fs");
 const node_os_1 = __importDefault(require("node:os"));
 const CODEX_GUARD_PROFILE = "navarch-worktree";
+const CODEX_GH_CONFIG_DIRNAME = "gh-config";
+const CODEX_GITHUB_NETWORK_DOMAINS = {
+    "**.github.com": "allow",
+    "**.githubusercontent.com": "allow",
+};
 const CLAUDE_USER_SETTINGS_FILENAME = "settings.json";
 /**
  * Tools the hook screens. Everything else — the lease-scoped Navarch MCP
@@ -122,6 +128,17 @@ function codexToolReadRoots(env = process.env) {
         node_path_1.default.join(homeDir, ".cache", "ms-playwright"),
     ];
 }
+/**
+ * Isolated gh configuration root for one Codex session.
+ *
+ * `gh` reads its config file before it considers `GITHUB_TOKEN`. Pointing it
+ * at this empty, session-owned directory lets the CLI use the lease token
+ * without granting the agent read access to the operator's ~/.config/gh,
+ * which may contain unrelated account credentials.
+ */
+function codexGhConfigDir(workDir) {
+    return node_path_1.default.join(workDir, CODEX_GH_CONFIG_DIRNAME);
+}
 /**
  * Builds one-off Codex permission-profile arguments for a host session.
  *
@@ -144,6 +161,7 @@ function codexWorktreeGuardArgs(options) {
         [node_path_1.default.resolve(options.workspaceRoot)]: "deny",
         [node_path_1.default.resolve(options.worktreePath)]: "write",
         [node_path_1.default.resolve(options.repositoryPath)]: "write",
+        [codexGhConfigDir(options.workDir)]: "read",
     };
     for (const root of codexToolReadRoots()) {
         const resolved = node_path_1.default.resolve(root);
@@ -173,10 +191,15 @@ function codexWorktreeGuardArgs(options) {
         `default_permissions=${tomlString(CODEX_GUARD_PROFILE)}`,
         "-c",
         `permissions.${CODEX_GUARD_PROFILE}.filesystem=${tomlInlineTable(filesystem)}`,
-        // Navarch coding tasks must be able to fetch dependencies and push their
-        // branch. The profile still constrains filesystem access independently.
+        // A network-enabled permission profile still blocks every destination
+        // until it has at least one allow rule. Keep routine authenticated GitHub
+        // CLI and git traffic inside the sandbox so it does not become an
+        // Auto-review escalation, while leaving every non-GitHub destination
+        // blocked. The profile still constrains filesystem access independently.
         "-c",
         `permissions.${CODEX_GUARD_PROFILE}.network.enabled=true`,
+        "-c",
+        `permissions.${CODEX_GUARD_PROFILE}.network.domains=${tomlInlineTable(CODEX_GITHUB_NETWORK_DOMAINS)}`,
     ];
 }
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sagentlab/navarch-runtime",
-  "version": "0.1.17",
+  "version": "0.1.19",
   "description": "Navarch machine-side session manager: claims delivery tasks and runs them through Claude Code, Codex, or Gemini CLI.",
   "type": "commonjs",
   "license": "MIT",